| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| admin | Parity Between Azure Information Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/admin/services-in-china/parity-between-azure-information-protection.md | The following list includes the existing gaps between AIP for Office 365 operate To configure AIP for customers in China: 1. [Enable Rights Management for the tenant](#step-1-enable-rights-management-for-the-tenant). -1. [Add the Microsoft Purview Information Protection Sync Service service principal](#step-2-add-the-microsoft-purview-information-protection-sync-service-service-principal). +1. [Add the Microsoft Information Protection Sync Service service principal](#step-2-add-the-microsoft-information-protection-sync-service-service-principal). 1. [Configure DNS encryption](#step-3-configure-dns-encryption). For the encryption to work correctly, RMS must be enabled for the tenant. 2. If the functional state is `Disabled`, run `Enable-AipService`. -### Step 2: Add the Microsoft Purview Information Protection Sync Service service principal +### Step 2: Add the Microsoft Information Protection Sync Service service principal -The **Microsoft Purview Information Protection Sync Service** service principal is not available in Azure China tenants by default, and is required for Azure Information Protection. Create this service principal manually via the Azure Az PowerShell module. +The **Microsoft Information Protection Sync Service** service principal is not available in Azure China tenants by default, and is required for Azure Information Protection. Create this service principal manually via the Azure Az PowerShell module. 1. If you don't have the Azure Az module installed, install it or use a resource where the Azure Az module comes preinstalled, such as [Azure Cloud Shell](/azure/cloud-shell/overview). For more information, see [Install the Azure Az PowerShell module](/powershell/azure/install-az-ps). The **Microsoft Purview Information Protection Sync Service** service principal Connect-azaccount -environmentname azurechinacloud ``` -1. Create the **Microsoft Purview Information Protection Sync Service** service principal manually using the [New-AzADServicePrincipal](/powershell/module/az.resources/new-azadserviceprincipal) cmdlet and the `870c4f2e-85b6-4d43-bdda-6ed9a579b725` application ID for the Microsoft Purview Information Protection Sync Service: +1. Create the **Microsoft Information Protection Sync Service** service principal manually using the [New-AzADServicePrincipal](/powershell/module/az.resources/new-azadserviceprincipal) cmdlet and the `870c4f2e-85b6-4d43-bdda-6ed9a579b725` application ID for the Microsoft Purview Information Protection Sync Service: ```powershell New-AzADServicePrincipal -ApplicationId 870c4f2e-85b6-4d43-bdda-6ed9a579b725 |
| compliance | Communication Compliance Policies | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/communication-compliance-policies.md | Communications are scanned every 24 hours from the time policies are created. Fo >[!NOTE] >Availability for user-reported messages for organizations licensed and using [communication compliance](/microsoft-365/compliance/communication-compliance-configure#subscriptions-and-licensing) and Microsoft Teams started in May 2022. This feature will be available by August 31, 2022 for all organizations licensed and using communication compliance through July 2022. For organizations starting to use communication compliance after July 2022, user-reported messages policy availability may take up to 30 days from the date of your licensing and first use of communication compliance. -As part of a layered defense to detect and remediate inappropriate messages in your organization, you can supplement communication compliance policies with user-reported messages in Microsoft Teams. This feature empowers users in your organization to self-report inappropriate internal chat messages, such as harassing or threatening language, sharing of adult content, and sharing of sensitive or confidential information, to help foster a safe and compliant work environment. +As part of a layered defense to detect and remediate inappropriate messages in your organization, you can supplement communication compliance policies with user-reported messages in Microsoft Teams. This feature empowers users in your organization to self-report inappropriate internal personal and group chat messages, such as harassing or threatening language, sharing of adult content, and sharing of sensitive or confidential information, to help foster a safe and compliant work environment. -Enabled by default in the [Teams admin center](/microsoftteams/manage-teams-in-modern-portal), the *Report a concern* option in Teams messages allows users in your organization to submit inappropriate internal chat messages for review by communication compliance reviewers for the policy. These messages are supported by a default system policy that supports reporting messages in Teams group and private chats. +Enabled by default in the [Teams admin center](/microsoftteams/manage-teams-in-modern-portal), the *Report a concern* option in Teams messages allows users in your organization to submit inappropriate internal personal and group chat messages for review by communication compliance reviewers for the policy. These messages are supported by a default system policy that supports reporting messages in Teams group and private chats.  |
| compliance | Compliance Easy Trials Compliance Manager Assessment Playbook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-easy-trials-compliance-manager-assessment-playbook.md | search.appverid: - MOE150 - MET150 description: "Microsoft Purview Compliance Manager premium assessments trial playbook."+ # Trial playbook: Microsoft Purview Compliance Manager premium assessments |
| compliance | Compliance Easy Trials Compliance Playbook | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-easy-trials-compliance-playbook.md | search.appverid: - MOE150 - MET150 description: "Microsoft Purview solutions trial playbook."+ # Trial playbook: Microsoft Purview solutions |
| compliance | Compliance Manager Mcca | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-manager-mcca.md | Title: "Microsoft Compliance Configuration Analyzer for Compliance Manager" + Title: "Configuration Analyzer for Microsoft Purview" f1.keywords: - NOCSH -description: "Understand how to use Microsoft Compliance Configuration Analyzer to get up and running quickly with Microsoft Purview Compliance Manager." +description: "Understand how to use Configuration Analyzer for Microsoft Purview to get up and running quickly with Microsoft Purview Compliance Manager." -# Microsoft Compliance Configuration Analyzer for Compliance Manager (preview) +# Configuration Analyzer for Microsoft Purview (CAMP) [!include[Purview banner](../includes/purview-rebrand-banner.md)] -**In this article:** Learn how to install and run the Microsoft Compliance Configure Analyzer tool to get quickly started with Microsoft Compliance Manger. +**In this article:** Learn how to install and run the Configuration Analyzer for Microsoft Purview (CAMP) tool to get quickly started with Microsoft Compliance Manger. -## Microsoft Compliance Configuration Analyzer (MCCA) (preview) overview +## Compliance Configuration Analyzer (CAMP) overview -The Microsoft Compliance Configuration Analyzer (MCCA) is a preview tool that can help you get started with [Microsoft Purview Compliance Manager](compliance-manager.md). MCCA is a PowerShell-based utility that will fetch your organization's current configurations and validate them against Microsoft 365 recommended best practices. These best practices are based on a set of controls that include key regulations and standards for data protection and data governance. +The Configuration Analyzer for Microsoft Purview (CAMP) is a tool that can help you get started with [Microsoft Purview Compliance Manager](compliance-manager.md). CAMP is a PowerShell-based utility that will fetch your organization's current configurations and validate them against Microsoft 365 recommended best practices. These best practices are based on a set of controls that include key regulations and standards for data protection and data governance. -MCCA can help you quickly see which improvement actions in Compliance Manager apply to your current Microsoft 365 environment. Each action identified by MCCA will give you recommendations for implementation, with direct links to Compliance Manager and the applicable solution to start taking corrective action. +CAMP can help you quickly see which improvement actions in Compliance Manager apply to your current Microsoft 365 environment. Each action identified by CAMP will give you recommendations for implementation, with direct links to Compliance Manager and the applicable solution to start taking corrective action. -An additional resource for understanding MCCA is by visiting the [README instructions on GitHub](https://github.com/OfficeDev/MCCA#overview). This page provides detailed information about prerequisites and gives full installation instructions. You don't need a GitHub account to access this page. +For more details about CAMP, including prerequisites and full installation instructions, visit the [README instructions on GitHub](https://github.com/OfficeDev/CAMP#overview). You don't need a GitHub account to access this page. -**Availability**: MCCA is available to all organizations with Office 365 and Microsoft 365 licenses and US Government Community (GCC) Moderate, GCC High, and Department of Defense (DoD) customers. +#### Availability +CAMP is available to all organizations with Office 365 and Microsoft 365 licenses and US Government Community (GCC) Moderate, GCC High, and Department of Defense (DoD) customers. -## Install MCCA and run a report +#### Roles -You can install the MCCA tool using Windows PowerShell. Once you download and install the tool, you don't need to repeat those steps in order to run reports. Each time you open MCCA, it will ask you for your login credentials, and it will generate a new, updated report. +Certain user roles are required to access and use CAMP, and to access information in reports. Visit the [CAMP prerequisite information on GitHub](https://github.com/OfficeDev/CAMP#pre-requisites). ++## Install CAMP and run a report ++You can install the CAMP tool using Windows PowerShell. Once you download and install the tool, you don't need to repeat those steps in order to run reports. Each time you open CAMP, it will ask you for you to log in, and it will generate a new, updated report. ### Step 1: Install the Exchange Online PowerShell V2 module To begin, you'll need the Exchange Online PowerShell module (v2.0.3 or higher) that's available in the PowerShell gallery. For installation instructions, see [Install and maintain the EXO V2 module](/powershell/exchange/exchange-online-powershell-v2#install-and-maintain-the-exo-v2-module). -### Step 2: Install MCCA +### Step 2: Install CAMP -To install MCCA, start by using PowerShell in administrator mode. Follow the steps below: +To install CAMP, start by using PowerShell in administrator mode. Follow the steps below: 1. Select the Windows **Start** button. 1. Type **PowerShell**, right-click on **Windows PowerShell**, then select **Run as administrator**. 1. At the command prompt, type: ```powershell- Install-Module -Name MCCAPreview + Install-Module -Name CAMP ``` ### Step 3: Run a report -After you install MCCA, you can run MCCA and generate a report. To run a report: +After you install CAMP, you can run CAMP and generate a report. To run a report: 1. Open PowerShell 2. Run the cmdlet: ```powershell- Get-MCCAReport + Get-CAMPReport ``` If you're a GCC High customer, you'll need to provide an additional input parameter to run the report: ```powershell- Get-MCCAReport -ExchangeEnvironmentName O365USGovGCCHigh + Get-CAMPReport -ExchangeEnvironmentName O365USGovGCCHigh ``` -3. Once MCCA runs, it does an initial version check and ask for credentials. At the Input the user name prompt, sign in with your Microsoft 365 account email address ([view the roles eligible to create reports](#role-based-reporting)). Then enter your password at the password prompt. +3. Once CAMP runs, it does an initial version check and ask for credentials. At the Input the user name prompt, sign in with your Microsoft 365 account email address ([view the roles eligible to create reports](https://github.com/OfficeDev/CAMP#pre-requisites)). Then enter your password at the password prompt. -Your report will then take approximately 2-5 minutes to generate. When it's done, a browser window opens and displays your HTML report. Every time you run the tool, it will ask for your credentials and generate a new report. This report is stored locally in the directory C: \ Users \ *username* \ AppData \ Local \ Microsoft \ MCCA. +Your report will then take approximately 2-5 minutes to generate. When it's done, a browser window opens and displays your HTML report. Every time you run the tool, it will ask for your credentials and generate a new report. This report is stored locally in the directory C: \ Users \ *username* \ AppData \ Local \ Microsoft \ CAMP. You can access previously generated reports from this directory. Follow these instructions to run a report based on a specific location: 2. To specify a certain region, you'll run a cmdlet using the numbers from the table below that correspond to the country or region. Enter multiple numbers by separating them with a comma. For example, the cmdlet below will run a customized report for Asia-Pacific and Japan: ```powershell- Get-MCCAReport -Geo @(1,7) + Get-CAMPReport -Geo @(1,7) ``` | Input | Country or Region | Follow these instructions to run a report based on a specific location: | 14 | United Kingdom | > [!NOTE]- > The report will always include MCCA supported international sensitive information types such as SWIFT code, credit card number, etc. + > The report will always include CAMP supported international sensitive information types such as SWIFT code, credit card number, etc. ### Role-based reporting -Your report will also be customized based on your role. --The table below shows which roles have access to which sections of the report. Other roles within your organization (not listed in the table below) may not be able to run the tool, or they may run the tool and have limited access to information in the final report. -- --Exceptions: --1. Users won't be able to generate report for IP apart from ΓÇ£Use IRM for Exchange OnlineΓÇ¥ section. -2. Users will be able to generate report for IP apart from ΓÇ£Use IRM for Exchange OnlineΓÇ¥ section. -3. Users will be able to generate report for IP apart from ΓÇ£Enable Communication Compliance in O365ΓÇ¥ section. -4. Users won't be able to generate report for IP apart from ΓÇ£Enable Auditing in Office 365ΓÇ¥ section. -5. Users will be able generate report for IP apart from ΓÇ£Enable Auditing in Office 365ΓÇ¥ section. +Your report will also be customized based on your role. The [CAMP prerequisite information on GitHub](https://github.com/OfficeDev/CAMP#pre-requisites) outlines which roles have access to which sections of the report. Other roles within your organization may not be able to run the tool, or they may run the tool and have limited access to information in the final report. ### Solutions Summary section The **Solutions Summary** section of the report gives an overview of improvement actions that your organization can take in Compliance Manager to help improve your compliance posture. - + -MCCA evaluates your current configurations against the recommended improvement actions in Compliance Manager. Any improvement action identified by the MCCA tool as needing attention will be listed in this section. +CAMP evaluates your current configurations against the recommended improvement actions in Compliance Manager. Any improvement action identified by the CAMP tool as needing attention will be listed in this section. Next to each Microsoft solution are color-coded boxes indicating the number of items that correspond to improvement actions in Compliance Manager. The actions are broken down into three status states: Select a box to view improvements and recommendations. Select the dropdown next to the **Improvement** label to the right of the improvement action. You'll see a quick summary and details about your current settings and the recommended improvement actions. The summary includes direct links into Compliance Manager, the applicable solution in the Microsoft Purview compliance portal, and relevant documentation. -Clicking on the Compliance Manager link takes you to a filtered view of all the improvement actions within that solution that you have not yet implemented. From there, you can see the number of points you can achieve to increase your [compliance score](compliance-score-calculation.md), and the assessments they apply to, and the applicable regulations and certifications. +Selecting the Compliance Manager link takes you to a filtered view of all the improvement actions within that solution that you haven't yet implemented. From there, you can see the number of points you can achieve to increase your [compliance score](compliance-score-calculation.md), and the assessments they apply to, and the applicable regulations and certifications. For DLP, there's a **Remediation Script** button that gives you a pre-generated PowerShell script based on what's recommended. You can copy and paste it directly in your PowerShell console. It will create a DLP policy in test mode Select the dropdown next to the **Recommendation** label to the right of the imp ## Resources -For more detailed information on installing, setting up, and using MCCA, see the [README instructions on GitHub](https://github.com/OfficeDev/MCCA#overview) (no GitHub account required). +For more detailed information on installing, setting up, and using CAMP, see the [README instructions on GitHub](https://github.com/OfficeDev/CAMP#overview) (no GitHub account required). For more information on Windows PowerShell, start at [How to use the PowerShell documentation](/powershell/scripting/how-to-use-docs). See also [Starting Windows PowerShell](/powershell/scripting/windows-powershell/starting-windows-powershell). |
| compliance | Compliance Manager Quickstart | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/compliance-manager-quickstart.md | Our [Compliance Manager overview page](compliance-manager.md) is the best first - [Filter your dashboard view](compliance-manager-setup.md#filtering-your-dashboard-view) - [Learn about improvement actions](compliance-manager-setup.md#improvement-actions-page) - [Understand assessments](compliance-manager.md#assessments)-- [Do a quick scan of your environment using the Microsoft Compliance Configuration Manager](compliance-manager-mcca.md)+- [Do a quick scan of your environment using the Configuration Analyzer for Microsoft Purview](compliance-manager-mcca.md) ## Ramping up: configure Compliance Manager to manage your compliance activities |
| compliance | Endpoint Dlp Getting Started | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/endpoint-dlp-getting-started.md | Topic | Description :|: [Onboard Windows 10 or 11 devices using Group Policy](device-onboarding-gp.md) | Use Group Policy to deploy the configuration package on devices. [Onboard Windows 10 or 11 devices using Microsoft Endpoint Configuration Manager](device-onboarding-sccm.md) | You can use either use Microsoft Endpoint Configuration Manager (current branch) version 1606 or Microsoft Endpoint Configuration Manager (current branch) version 1602 or earlier to deploy the configuration package on devices.-[Onboard Windows 10 or 11 devices using Mobile Device Management tools](device-onboarding-mdm.md) | Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on device. +[Onboard Windows 10 or 11 devices using Microsoft Intune](device-onboarding-mdm.md) | Use Microsoft Intune to deploy the configuration package on device. [Onboard Windows 10 or 11 devices using a local script](device-onboarding-script.md) | Learn how to use the local script to deploy the configuration package on endpoints. [Onboard non-persistent virtual desktop infrastructure (VDI) devices](device-onboarding-vdi.md) | Learn how to use the configuration package to configure VDI devices. Topic | Description |[Onboard and offboard macOS devices into Microsoft Purview solutions using JAMF Pro)](device-onboarding-offboarding-macos-jamfpro.md) | For macOS devices that are managed through JAMF Pro |[Onboard and offboard macOS devices into Compliance solutions using JAMF Pro for Microsoft Defender for Endpoint customers)](device-onboarding-offboarding-macos-jamfpro-mde.md)|For macOS devices that are managed through JAMF Pro and that have Microsoft Defender for Endpoint (MDE) deployed to them -Once an device is onboarded, it should be visible in the devices list and also start reporting audit activity to Activity explorer. +Once a device is onboarded, it should be visible in the devices list and also start reporting audit activity to Activity explorer. <!--### Permissions |
| compliance | Endpoint Dlp Learn About | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/endpoint-dlp-learn-about.md | Onboarding and offboarding are handled via scripts you download from the Device Use the procedures in [Getting started with Microsoft 365 Endpoint DLP](endpoint-dlp-getting-started.md) to onboard devices. -If you have onboarded devices through [Microsoft Defender for Endpoint](/windows/security/threat-protection/), those devices will automatically show up in the list of devices. You can **Turn on device monitoring** to use endpoint DLP. +If you have onboarded devices through [Microsoft Defender for Endpoint](../security/defender-endpoint/configure-machines-onboarding.md), those devices will automatically show up in the list of devices. This is because onboarding to Defender also onboards devices to DLP. You only need to **Turn on device monitoring** to use endpoint DLP. . > [!div class="mx-imgBorder"] >  |
| compliance | Event Driven Retention | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/compliance/event-driven-retention.md | You can use a PowerShell script to automate event-based retention from your busi - [New-ComplianceRetentionEvent](/powershell/module/exchange/new-complianceretentionevent) +to help identify other cmdlets to create retention labels and their policies, see [PowerShell cmdlets for retention policies and retention labels](retention-cmdlets.md). + ## Automate events by using a REST API You can use a REST API to automatically create the events that trigger the start of the retention time. +> [!NOTE] +> Now rolling out in preview, you can alternatively use [Microsoft Graph API for records management](compliance-extensibility.md#microsoft-graph-api-for-records-management-preview) to create the event, and also create event types and retention labels. +> +> We encourage you to try these Graph APIs because the REST APIs in this section will soon be deprecated and stop working. + A REST API is a service endpoint that supports sets of HTTP operations (methods), which provide create/retrieve/update/delete access to the service's resources. For more information, see [Components of a REST API request/response](/rest/api/gettingstarted/#components-of-a-rest-api-requestresponse). By using the Microsoft 365 REST API, events can be created and retrieved using the POST and GET methods. There are two options for using the REST API: |
| includes | Office 365 U.S. Government Dod Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-u.s.-government-dod-endpoints.md | <!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--USGovDoD endpoints version 2022060100--> -<!--File generated 2022-06-01 08:00:04.9385--> +<!--USGovDoD endpoints version 2022062900--> +<!--File generated 2022-06-29 08:00:20.3239--> ## Exchange Online ID | Category | ER | Addresses | Ports 29 | Default<BR>Required | No | `dod-mtis.cortana.ai` | **TCP:** 443 30 | Default<BR>Required | No | `*.aadrm.us, *.informationprotection.azure.us` | **TCP:** 443 31 | Default<BR>Required | No | `pf.events.data.microsoft.com, pf.pipe.aria.microsoft.com` | **TCP:** 443, 80+32 | Default<BR>Required | No | `<tenant>.config.dod.office365.us, config.apps.mil` | **TCP:** 443 |
| includes | Office 365 U.S. Government Gcc High Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-u.s.-government-gcc-high-endpoints.md | <!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--USGovGCCHigh endpoints version 2022060100--> -<!--File generated 2022-06-01 08:00:06.2025--> +<!--USGovGCCHigh endpoints version 2022062900--> +<!--File generated 2022-06-29 08:00:21.6441--> ## Exchange Online ID | Category | ER | Addresses | Ports ## Skype for Business Online and Microsoft Teams ID | Category | ER | Addresses | Ports | -- | | | -7 | Optimize<BR>Required | Yes | `*.gov.teams.microsoft.us, *.infra.gov.skypeforbusiness.us, *.online.gov.skypeforbusiness.us, gov.teams.microsoft.us`<BR>`52.127.88.0/21, 52.238.114.160/32, 52.238.115.146/32, 52.238.117.171/32, 52.238.118.132/32, 52.247.167.192/32, 52.247.169.1/32, 52.247.172.50/32, 52.247.172.103/32, 104.212.44.0/22, 195.134.228.0/22` | **TCP:** 443, 80<BR>**UDP:** 3478, 3479, 3480, 3481 +-- | -- | | | - +7 | Optimize<BR>Required | Yes | `52.127.88.0/21, 104.212.44.0/22, 195.134.228.0/22` | **UDP:** 3478, 3479, 3480, 3481 21 | Default<BR>Required | No | `msteamsstatics.blob.core.usgovcloudapi.net, statics.teams.microsoft.com, teamsapuiwebcontent.blob.core.usgovcloudapi.net` | **TCP:** 443-31 | Allow<BR>Required | Yes | `*.gov.skypeforbusiness.us, *.gov.teams.microsoft.us, gov.teams.microsoft.us` | **TCP:** 443, 80 +31 | Allow<BR>Required | Yes | `*.gov.skypeforbusiness.us, *.gov.teams.microsoft.us, gov.teams.microsoft.us`<BR>`52.127.88.0/21, 104.212.44.0/22, 195.134.228.0/22` | **TCP:** 443, 80 ## Microsoft 365 Common and Office Online ID | Category | ER | Addresses | Ports 29 | Default<BR>Required | No | `gcch-mtis.cortana.ai` | **TCP:** 443 30 | Default<BR>Required | No | `*.aadrm.us, *.informationprotection.azure.us` | **TCP:** 443 32 | Default<BR>Required | No | `tb.events.data.microsoft.com, tb.pipe.aria.microsoft.com` | **TCP:** 443, 80+33 | Default<BR>Required | No | `<tenant>.config.high.office365.us` | **TCP:** 443 |
| includes | Office 365 Worldwide Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/includes/office-365-worldwide-endpoints.md | <!--THIS FILE IS AUTOMATICALLY GENERATED. MANUAL CHANGES WILL BE OVERWRITTEN.--> <!--Please contact the Office 365 Endpoints team with any questions.--> -<!--Worldwide endpoints version 2022060100--> -<!--File generated 2022-06-01 08:00:02.7692--> +<!--Worldwide endpoints version 2022062900--> +<!--File generated 2022-06-29 08:00:15.9343--> ## Exchange Online |
| security | Mdb Onboard Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/mdb-onboard-devices.md | To view the list of devices that are onboarded to Defender for Business, in the ## Mobile devices -You'll need Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. If you have [Microsoft 365 Business Premium](../../business/index.yml), you've Intune. +You'll need Microsoft Intune to onboard mobile devices, such as Android and iOS/iPadOS devices. If you have [Microsoft 365 Business Premium](../../business/index.yml), you have Intune. See the following resources to get help enrolling these devices into Intune: |
| security | Trial Playbook Defender Business | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-business/trial-playbook-defender-business.md | search.appverid: - MOE150 - MET150 description: "Make the most of your Defender for Business trial with this playbook. Get set up quickly and get started using your new security capabilities."+ # Trial playbook: Microsoft Defender for Business |
| security | TOC | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/TOC.md | #### [Use PowerShell, WMI, or MPCmdRun.exe](manage-mde-post-migration-other-tools.md) #### [Server migration scenarios](server-migration.md) -## [Configure and onboard devices]() +## [Onboard and configure devices]() ### [Onboard devices and configure Microsoft Defender for Endpoint capabilities](onboard-configure.md)+### [Onboarding Windows Client](onboard-windows-client.md) +#### [Onboard Windows Client using Intune](configure-endpoints-mdm.md) +#### [Onboard Windows Client using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) +#### [Onboard Windows Client using Group Policy](configure-endpoints-gp.md) +#### [Onboard Windows Client using a local script](configure-endpoints-script.md) +#### [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) +#### [Onboard Windows 10 multi-session devices in Windows Virtual Desktop](onboard-windows-multi-session-device.md) +#### [Onboard devices without Internet access](onboard-offline-machines.md) +#### [Onboard previous versions of Windows](onboard-downlevel.md) -### [Microsoft Defender for Endpoint on Windows and Windows Server]() -#### [Onboarding tools and methods for Windows endpoints](configure-endpoints.md) -#### [Onboard Windows devices and Windows Servers]() -##### [Onboard previous versions of Windows](onboard-downlevel.md) +### [Onboarding Windows Server](onboard-windows-server.md) +#### [Onboard Windows Server 2012 R2, 2016, Semi-Annual Channel, 2019, and 2022](configure-server-endpoints.md) +#### [Onboard Windows Server using Configuration Manager](configure-endpoints-sccm.md) +#### [Onboard Windows Server devices using Group Policy](configure-endpoints-gp.md) +#### [Onboard Windows Server using a local script](configure-endpoints-script.md) +#### [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) ++ -##### [Onboard Windows devices and Windows Servers]() -###### [Onboard Windows Server 2012 R2, 2016, Semi-Annual Channel, 2019, and 2022](configure-server-endpoints.md) -###### [Onboard Windows devices using a local script](configure-endpoints-script.md) -###### [Onboard Windows devices using Group Policy](configure-endpoints-gp.md) -###### [Onboard Windows devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) -###### [Onboard Windows devices using Mobile Device Management tools](configure-endpoints-mdm.md) -###### [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) -###### [Onboard Windows 10 multi-session devices in Windows Virtual Desktop](onboard-windows-multi-session-device.md) -#### [Integration with Microsoft Defender for Cloud](azure-server-integration.md) -#### [Onboard devices without Internet access](onboard-offline-machines.md) -#### [Run a detection test on a newly onboarded device](run-detection-test.md) -#### [Run simulated attacks on devices](attack-simulations.md) -#### [Configure proxy and Internet connectivity settings](configure-proxy-internet.md) -#### [Create an onboarding or offboarding notification rule](onboarding-notification.md) ### [Microsoft Defender for Endpoint on other Operating Systems]() #### [Onboard non-Windows devices](configure-endpoints-non-windows.md) ###### [Privacy](ios-privacy.md) +++### [Integration with Microsoft Defender for Cloud](azure-server-integration.md) +### [Run a detection test on a newly onboarded device](run-detection-test.md) +### [Run simulated attacks on devices](attack-simulations.md) +### [Configure proxy and Internet connectivity settings](configure-proxy-internet.md) +### [Create an onboarding or offboarding notification rule](onboarding-notification.md) + ### [Manage Microsoft Defender for Endpoint configuration settings on devices with Microsoft Endpoint Manager](security-config-management.md) ### [Troubleshoot onboarding issues]() |
| security | Configure Endpoints Mdm | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints-mdm.md | Title: Onboard Windows devices using Mobile Device Management tools -description: Use Mobile Device Management tools to deploy the configuration package on devices so that they are onboarded to the Defender for Endpoint service. + Title: Onboard Windows devices to Defender for Endpoint using Intune +description: Use Microsoft Intune to deploy the configuration package on devices so that they are onboarded to the Defender for Endpoint service. keywords: onboard devices using mdm, device management, onboard Microsoft Defender for Endpoint devices, mdm ms.prod: m365-security ms.mktglfcycl: deploy-# Onboard Windows devices using Mobile Device Management tools +# Onboard Windows devices to Defender for Endpoint using Intune [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] ms.technology: mde You can use mobile device management (MDM) solutions to configure Windows 10 devices. Defender for Endpoint supports MDMs by providing OMA-URIs to create policies to manage devices. - For more information on using Defender for Endpoint CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx). ## Before you begin -If you're using Microsoft Intune, you must have the device MDM Enrolled. Otherwise, settings won't be applied successfully. +Devices must be enrolled with Intune as your Mobile Device Management (MDM) solution. For more information on enabling MDM with Microsoft Intune, see [Device enrollment (Microsoft Intune)](/mem/intune/enrollment/device-enrollment). For more information on using Defender for Endpoint CSP see, [WindowsAdvancedThr > > - The **Health Status for onboarded devices** policy uses read-only properties and can't be remediated. > - Configuration of diagnostic data reporting frequency is only available for devices on Windows 10, version 1703.+> - Onboarding to Defender for Endpoint will onboard the device to [Data Loss Prevention (DLP)](../../compliance/endpoint-dlp-learn-about.md), which is also a part of Microsoft 365 compliance. -Check out the [PDF](https://download.microsoft.com/download/5/6/0/5609001f-b8ae-412f-89eb-643976f6b79c/mde-deployment-strategy.pdf) or [Visio](https://download.microsoft.com/download/5/6/0/5609001f-b8ae-412f-89eb-643976f6b79c/mde-deployment-strategy.vsdx) to see the various paths in deploying Microsoft Defender for Endpoint. - ## Run a detection test to verify onboarding After onboarding the device, you can choose to run a detection test to verify that a device is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender for Endpoint device](run-detection-test.md). -## Offboard and monitor devices using Mobile Device Management tools +## Offboard devices using Mobile Device Management tools For security reasons, the package used to Offboard devices will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a device will be rejected. When downloading an offboarding package you'll be notified of the packages expiry date and it will also be included in the package name. |
| security | Configure Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-endpoints.md | - Title: Onboarding tools and methods for Windows devices -description: Onboard Windows devices so that they can send sensor data to the Microsoft Defender for Endpoint sensor -keywords: Onboard Windows devices, group policy, endpoint configuration manager, mobile device management, local script, gp, sccm, mdm, intune -search.product: eADQiWindows 10XVcnh -ms.sitesec: library -ms.pagetype: security ----- - M365-security-compliance - - m365-initiative-defender-endpoint ----# Onboarding tools and methods for Windows devices in Defender for Endpoint ---**Applies to:** --- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037)-- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)-- [Endpoint data loss prevention (DLP)](/microsoft-365/compliance/endpoint-dlp-learn-about)-- [Insider risk management](/microsoft-365/compliance/insider-risk-management)--> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-assignaccess-abovefoldlink) --Devices in your organization must be configured so that the Defender for Endpoint service can get sensor data from them. There are various methods and deployment tools that you can use to configure the devices in your organization. --In general, you'll identify the Windows device you're onboarding, then follow the corresponding tool appropriate to the device or your environment. ---## Endpoint onboarding tools --Depending on the Windows endpoint you want to onboard, use the corresponding tool or method described in the following table. --Windows device | Onboarding tool or method -:|: -|<ul><li> Windows 10</li> <li>Windows Server 1803 and 2019, and 2022</li> <li>Windows Server 2012 R2 and 2016<sup>[[1](#fn1)]<sup></li></ul> | [Local script (up to 10 devices)](configure-endpoints-script.md)<br> [Group Policy](configure-endpoints-gp.md)<br> [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [Microsoft Endpoint Manager/ Mobile Device Management (Intune)](configure-endpoints-mdm.md)<br> [VDI scripts](configure-endpoints-vdi.md) <br><br> **NOTE**: A local script is suitable for a proof of concept but should not be used for production deployment. For a production deployment, we recommend using Group Policy, Microsoft Endpoint Configuration Manager, or Intune. -|<ul><li> Windows Server 2008 R2 SP1 </li></ul>| [Microsoft Monitoring Agent (MMA)](onboard-downlevel.md) <br>[Onboard previous versions of Windows](onboard-downlevel.md) or [Microsoft Defender for Cloud](/azure/security-center/security-center-wdatp) <br><br> **NOTE**: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see [Log Analytics agent overview](/azure/azure-monitor/platform/log-analytics-agent). -|<ul><li> Windows 7 SP1 </li> <li> Windows 7 SP1 Pro </li> <li> Windows 8.1 Pro </li> <li> Windows 8.1 Enterprise</li></ul> | [Microsoft Monitoring Agent (MMA)](onboard-downlevel.md) <br><br> **NOTE**: Microsoft Monitoring Agent is now Azure Log Analytics agent. To learn more, see [Log Analytics agent overview](/azure/azure-monitor/platform/log-analytics-agent). --(<a id="fn1">1</a>) Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2012-r2-and-windows-server-2016). -->[!IMPORTANT] ->In order to be eligible to purchase Microsoft Defender for Endpoint Server SKU, you must have already purchased a combined minimum of any of the following, Windows E5/A5, Microsoft 365 E5/A5 or Microsoft 365 E5 Security subscription licenses. For more information on licensing, see the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftDefenderforEndpointServer/all). --Topic|Description -:|: -[Onboard devices using Group Policy](configure-endpoints-gp.md)|Use Group Policy to deploy the configuration package on devices. -[Onboard devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md)|You can use either use Microsoft Endpoint Manager (current branch) version 1606 or Microsoft Endpoint Manager (current branch) version 1602 or earlier to deploy the configuration package on devices. -[Onboard devices using Mobile Device Management tools](configure-endpoints-mdm.md)|Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on device. -[Onboard devices using a local script](configure-endpoints-script.md)|Learn how to use the local script to deploy the configuration package on endpoints. -[Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md)|Learn how to use the configuration package to configure VDI devices. --> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-configureendpoints-belowfoldlink) --After onboarding the device, you can choose to run a detection test to verify that a device is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender for Endpoint device](run-detection-test.md). |
| security | Configure Server Endpoints | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/configure-server-endpoints.md | Workaround: You can use the PowerShell command: Import-Certificate -FilePath .\InterCA.cer -CertStoreLocation Cert:\LocalMachine\Ca +## Integration with Microsoft Defender for Cloud ++Microsoft Defender for Endpoint integrates seamlessly with Microsoft Defender for Cloud. You can onboard servers automatically, have servers monitored by Microsoft Defender for Cloud appear in Defender for Endpoint, and conduct detailed investigations as a Microsoft Defender for Cloud customer. ++For more information, see [Integration with Microsoft Defender for Cloud](azure-server-integration.md). Servers onboarded through Microsoft Defender for Cloud will have their initial configuration set to run Defender Antivirus in [passive mode](/defender-endpoint/microsoft-defender-antivirus-compatibility#microsoft-defender-antivirus-and-non-microsoft-antivirusantimalware-solutions). ++> [!NOTE] +> - The integration between Microsoft Defender for servers and Microsoft Defender for Endpoint has been expanded to support Windows Server 2022, [Windows Server 2019, and Windows Virtual Desktop (WVD)](/azure/security-center/release-notes#microsoft-defender-for-endpoint-integration-with-azure-defender-now-supports-windows-server-2019-and-windows-10-virtual-desktop-wvd-in-preview). +> - Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers. + ## Windows Server 2012 R2 and Windows Server 2016 ### Prerequisites The installer package will check if the following components have already been i #### Prerequisites for running with third-party security solutions -If you intend to use a third-party antimalware solution, you'll need to run Microsoft Defender Antivirus in passive mode. You must remember to set to passive mode during the installation and onboarding process. +If you intend to use a third-party anti-malware solution, you'll need to run Microsoft Defender Antivirus in passive mode. You must remember to set to passive mode during the installation and onboarding process. > [!NOTE] > If you're installing Microsoft Defender for Endpoint on Servers with McAfee Endpoint Security (ENS) or VirusScan Enterprise (VSE), the version of the McAfee platform may need to be updated to ensure Microsoft Defender Antivirus is not removed or disabled. For more information including the specific version numbers required, see, [McAfee Knowledge Center article](https://kc.mcafee.com/corporate/index?page=content&id=KB88214). You will need to download both the **installation** and **onboarding** packages > [!NOTE] > On Windows Server 2012R2, Microsoft Defender Antivirus will get installed by the installation package and will be active unless you set it to passive mode. On Windows Server 2016, Microsoft Defender Antivirus must be installed as a feature (see [Switch to MDE](/microsoft-365/security/defender-endpoint/switch-to-mde-phase-2#re-enable-microsoft-defender-antivirus-on-windows-server-2016)) first and fully updated before proceeding with the installation. >- > If you are running a non-Microsoft antimalware solution ensure you add exclusions for Microsoft Defender Antivirus ([from this list of Microsoft Defender Processes on the Defender Processes tab](https://download.microsoft.com/download/6/b/f/6bfff670-47c3-4e45-b01b-64a2610eaefa/mde-urls-commercial.xlsx)) to the non-Microsoft solution before installation. It is also recommended to add non-Microsoft security solutions to the Defender Antivirus exclusion list. + > If you are running a non-Microsoft anti-malware solution ensure you add exclusions for Microsoft Defender Antivirus ([from this list of Microsoft Defender Processes on the Defender Processes tab](https://download.microsoft.com/download/6/b/f/6bfff670-47c3-4e45-b01b-64a2610eaefa/mde-urls-commercial.xlsx)) to the non-Microsoft solution before installation. It is also recommended to add non-Microsoft security solutions to the Defender Antivirus exclusion list. The **installation package** contains an MSI file that installs the Microsoft Defender for Endpoint agent. You can offboard Windows Server 2012 R2, Windows Server 2016, Windows Server (SA - [Offboard devices using Group Policy](configure-endpoints-gp.md#offboard-devices-using-group-policy) - [Offboard devices using Configuration Manager](configure-endpoints-sccm.md#offboard-devices-using-configuration-manager)-- [Offboard and monitor devices using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-and-monitor-devices-using-mobile-device-management-tools)+- [Offboard devices using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-devices-using-mobile-device-management-tools) - [Offboard devices using a local script](configure-endpoints-script.md#offboard-devices-using-a-local-script) After offboarding, you can proceed to uninstall the unified solution package on Windows Server 2012 R2 and Windows Server 2016. |
| security | Data Storage Privacy | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/data-storage-privacy.md | No. Customer data is isolated from other customers and is not shared. However, i ### At service onboarding -By default, data is retained for 180 days; however, you can specify the data retention policy for your data. This determines how long Window Defender for Endpoint will store your data. There's a flexibility of choosing in the range of one month to six months to meet your company's regulatory compliance needs. +By default, data is retained for 180 days; however, you can specify the data retention policy for your data. This determines how long Microsoft Defender for Endpoint will store your data. There's a flexibility of choosing in the range of one month to six months to meet your company's regulatory compliance needs. ### At contract termination or expiration |
| security | Event Error Codes | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/event-error-codes.md | For example, if devices aren't appearing in the **Devices list**, you might need |51|New cloud configuration failed to apply, version: %1. Successfully applied the last known good configuration, version %2.|Received a bad configuration file from the cloud service. Last known good configuration was applied successfully.|If this error persists, contact Support.| |52|New cloud configuration failed to apply, version: %1. Also failed to apply last known good configuration, version %2. Successfully applied the default configuration.|Received a bad configuration file from the cloud service. Failed to apply the last known good configuration - and the default configuration was applied.|The service will attempt to download a new configuration file within 5 minutes. If you don't see event #50 - contact Support.| |53|Cloud configuration loaded from persistent storage, version: %1.|The configuration was loaded from persistent storage on service startup.|Normal operating notification; no action required.|+ |54| Global (per-pattern) state changed. State: %1, pattern: %2 | If state = 0: Cyber-data reporting rule has reached its defined capping quota and won't send more data until the capping quota expires. If state = 1: The capping quota expired and the rule will resume sending data. | Normal operating notification; no action required. | |55|Failed to create the Secure ETW autologger. Failure code: %1|Failed to create the secure ETW logger.|Reboot the device. If this error persists, contact Support.| |56|Failed to remove the Secure ETW autologger. Failure code: %1|Failed to remove the secure ETW session on offboarding.|Contact Support.| |57|Capturing a snapshot of the machine for troubleshooting purposes.|An investigation package, also known as forensics package, is being collected.|Normal operating notification; no action required.| For example, if devices aren't appearing in the **Devices list**, you might need - [Troubleshoot Microsoft Defender for Endpoint](troubleshoot-onboarding.md) - [Client analyzer overview](overview-client-analyzer.md) - [Download and run the client analyzer](download-client-analyzer.md)-- [Understand the analyzer HTML report](analyzer-report.md)+- [Understand the analyzer HTML report](analyzer-report.md) |
| security | Exploit Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/exploit-protection.md | Last updated 10/19/2021 Exploit protection automatically applies many exploit mitigation techniques to operating system processes and apps. Exploit protection is supported beginning with Windows 10, version 1709, Windows 11, and Windows Server, version 1803. -> [!TIP] -> You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works. --> [!NOTE] -> The Defender for Endpoint demo site at demo.wd.microsoft.com is deprecated and will be removed in the future. - Exploit protection works best with [Defender for Endpoint](microsoft-defender-endpoint.md) - which gives you detailed reporting into exploit protection events and blocks as part of the usual [alert investigation scenarios](investigate-alerts.md). You can [enable exploit protection](enable-exploit-protection.md) on an individual device, and then use [Group Policy](import-export-exploit-protection-emet-xml.md) to distribute the XML file to multiple devices at once. The table in this section indicates the availability and support of native mitig ## See also -- [Protect devices from exploits](exploit-protection.md) - [Configure and audit exploit protection mitigations](customize-exploit-protection.md) - [Troubleshoot exploit protection](troubleshoot-exploit-protection-mitigations.md) - [Optimize ASR rule deployment and detections](configure-machines-asr.md) |
| security | Linux Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/linux-whatsnew.md | This article is updated frequently to let you know what's new in the latest rele  Released: **June 24, 2022**<br/>  Published: **June 24, 2022**<br/>  Build: **101.71.18**<br/>- Release version: **30.122042.16880.0**<br/> + Release version: **30.122052.17118.0**<br/> **What's new** |
| security | Machines View Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/machines-view-overview.md | Filter | Description **Onboarding status** </br> | Onboarding status indicates whether the device is currently onboarded to Microsoft Defender for Endpoint or not. You can filter by the following states: </br> - **Onboarded**: The endpoint is onboarded to Microsoft Defender for Endpoint. </br> - **Can be onboarded**: The endpoint was discovered in the network as a supported device, but it's not currently onboarded. Microsoft highly recommends onboarding these devices. </br> - **Unsupported**: The endpoint was discovered in the network, but is not supported by Microsoft Defender for Endpoint. </br> - **Insufficient info**: The system couldn't determine the supportability of the device.</br></br> (_Computers and mobile only_) **Antivirus status** </br> | Filter the view based on whether the antivirus status is disabled, not updated or unknown.</br></br> (_Computers and mobile only_) **Group** </br> | Filter the list based on the group you're interested in investigating. </br></br> (_Computers and mobile only_)-**Managed by** </br> | Managed by indicates how the device is being managed. You can filter by:</br>- Microsoft Defender for Endpoint </br> - Mobile device management (MDM) </br>- Unknown: This could be due the running an outdated Windows version, SCCM being in place, or another third party MDM.</br></br> (_Computers and mobile only_) +**Managed by** </br> | Managed by indicates how the device is being managed. You can filter by:</br> - Microsoft Defender for Endpoint</br> - Microsoft Endpoint Manager (MEM), including co-management with Microsoft Configuration Manager via tenant attach</br>- Microsoft Configuration manager (ConfigMgr)</br> - Unknown: This could be due the running an outdated Windows version, GPO management, or another third party MDM.</br></br> (_Computers and mobile only_) **Device Type** </br> | Filter by the device type you're interested in investigating.</br></br> (_IoT devices only_) ## Use columns to customize the device inventory views |
| security | Network Protection | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/network-protection.md | Last updated **Platforms** - Windows+- macOS +- Linux Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) Watch this video to learn how Network protection helps reduce the attack surface ## Requirements for network protection -Network protection requires Windows 10 or 11 (Pro or Enterprise), or Windows Server version 1803 or later, and Microsoft Defender Antivirus real-time protection. +Network protection requires Windows 10 or 11 (Pro or Enterprise), Windows Server version 1803 or later, macOS version 11 or later, or Defender Supported Linux versions, and Microsoft Defender Antivirus real-time protection. | Windows version | Microsoft Defender Antivirus | |:|:| DeviceEvents > [!TIP] > These entries have data in the **AdditionalFields** column which gives you great info around the action, if you expand **AdditionalFields** you can also get the fields: **IsAudit**, **ResponseCategory**, and **DisplayName**. -Here's an another example: +Here's another example: ```kusto |
| security | Offboard Machines | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/offboard-machines.md | Follow the corresponding instructions depending on your preferred deployment met - [Offboard devices using a local script](configure-endpoints-script.md#offboard-devices-using-a-local-script) - [Offboard devices using Group Policy](configure-endpoints-gp.md#offboard-devices-using-group-policy)-- [Offboard devices using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-and-monitor-devices-using-mobile-device-management-tools)+- [Offboard devices using Mobile Device Management tools](configure-endpoints-mdm.md#offboard-devices-using-mobile-device-management-tools) ## Offboard Servers |
| security | Onboard Configure | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-configure.md | Deploying Microsoft Defender for Endpoint is a two-step process. ## Onboard devices to the service You'll need to go the onboarding section of the Defender for Endpoint portal to onboard any of the supported devices. Depending on the device, you'll be guided with appropriate steps and provided management and deployment tool options suitable for the device. -In general, to onboard devices to the service: +To onboard devices to the service: - Verify that the device fulfills the [minimum requirements](minimum-requirements.md) - Depending on the device, follow the configuration steps provided in the onboarding section of the Defender for Endpoint portal - Use the appropriate management tool and deployment method for your devices - Run a detection test to verify that the devices are properly onboarded and reporting to the service -+This article provides information on onboarding methods applicable to Windows Client and Server versions. ## Onboarding and configuration tool options The following table lists the available tools based on the endpoint that you need to onboard. | Endpoint | Tool options | |--||-| **Windows** | [Local script (up to 10 devices)](configure-endpoints-script.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [Microsoft Endpoint Manager/ Mobile Device Manager](configure-endpoints-mdm.md) <br> [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [VDI scripts](configure-endpoints-vdi.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud) | +| **Windows Client** | [Mobile Device Management / Microsoft Intune](configure-endpoints-mdm.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [Local script (up to 10 devices)](configure-endpoints-script.md) <br>[VDI scripts](configure-endpoints-vdi.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud) | +| **Windows Server** | [Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) <br> [Group Policy](configure-endpoints-gp.md) <br> [VDI scripts](configure-endpoints-vdi.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud) | | **macOS** | [Local scripts](mac-install-manually.md) <br> [Microsoft Endpoint Manager](mac-install-with-intune.md) <br> [JAMF Pro](mac-install-with-jamf.md) <br> [Mobile Device Management](mac-install-with-other-mdm.md) |-| **Linux Server** | [Local script](linux-install-manually.md) <br> [Puppet](linux-install-with-puppet.md) <br> [Ansible](linux-install-with-ansible.md)| -| **iOS** | [Microsoft Endpoint Manager](ios-install.md) | +| **Linux Server** | [Local script](linux-install-manually.md) <br> [Puppet](linux-install-with-puppet.md) <br> [Ansible](linux-install-with-ansible.md) <br> [Integration with Microsoft Defender for Cloud](configure-server-endpoints.md#integration-with-microsoft-defender-for-cloud) | +| **iOS** | [Microsoft Endpoint Manager](ios-install.md) | | **Android** | [Microsoft Endpoint Manager](android-intune.md) | +> [!NOTE] +> For devices that aren't managed by a Microsoft Endpoint Manager (either Microsoft Intune or Microsoft Endpoint Configuration Manager), you can use the Security Management for Microsoft Defender for Endpoint to receive security configurations for Microsoft Defender directly from Endpoint Manager. + The following table lists the available tools based on the endpoint that you need to onboard. ## Configure capabilities of the service |
| security | Onboard Downlevel | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-downlevel.md | Follow the steps in [Run a detection test on a newly onboarded device](run-detec ### Using Group Policy -**Step 1: Download the corresponding udpate for your endpoint.** +**Step 1: Download the corresponding update for your endpoint.** 1. Navigate to c:\windows\sysvol\domain\scripts (Change control could be needed on one of the domain controllers.) 1. Create a folder named MMA. The following command is an example. Replace the following values: ```dos-@echo off -cd "C:" -IF EXIST "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" ( -exit -) ELSE ( --wusa.exe C:\Windows\MMA\Windows6.1-KB3080149-x64.msu /quiet /norestart -wusa.exe C:\Windows\MMA\Windows6.1-KB4074598-x64.msu /quiet /norestart -wusa.exe C:\Windows\MMA\Windows6.1-KB3154518-x64.msu /quiet /norestart -wusa.exe C:\Windows\MMA\Windows8.1-KB3080149-x64.msu /quiet /norestart -"c:\windows\MMA\MMASetup-AMD64.exe" /c /t: "C:\Windows\MMA"c:\windows\MMA\ setup.exe /qn NOAPM=1 ADD_OPINSIGHTS_WORKSPACE=1 -OPINSIGHTS_WORKSPACE_ID="<your workspace ID>" -OPINSIGHTS_WORKSPACE_KEY="<your workspace key>" AcceptEndUserLicenseAgreement=1 -) --) +@echo off +cd "C:" +IF EXIST "C:\Program Files\Microsoft Monitoring Agent\Agent\MonitoringHost.exe" ( +exit +) ELSE ( + +wusa.exe C:\Windows\MMA\Windows6.1-KB3080149-x64.msu /quiet /norestart +wusa.exe C:\Windows\MMA\Windows6.1-KB4074598-x64.msu /quiet /norestart +wusa.exe C:\Windows\MMA\Windows6.1-KB3154518-x64.msu /quiet /norestart +wusa.exe C:\Windows\MMA\Windows8.1-KB3080149-x64.msu /quiet /norestart +"c:\windows\MMA\MMASetup-AMD64.exe" /c /t:"C:\Windows\MMA" +c:\windows\MMA\setup.exe /qn NOAPM=1 ADD_OPINSIGHTS_WORKSPACE=1 OPINSIGHTS_WORKSPACE_ID="<your workspace ID>" OPINSIGHTS_WORKSPACE_KEY="<your workspace key>" AcceptEndUserLicenseAgreement=1 ++) ``` |
| security | Onboard Windows Client | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-windows-client.md | + + Title: Defender for Endpoint onboarding Windows Client +description: Onboard Windows Client. +keywords: onboarding, Microsoft Defender for Endpoint onboarding, sccm, group policy, mdm, local script, detection test +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - M365-security-compliance + - m365-initiative-defender-endpoint ++ms.technology: mde +++# Defender for Endpoint onboarding Windows Client +++**Applies to:** +- [Microsoft Defender for Endpoint Plan 2](https://go.microsoft.com/fwlink/p/?linkid=2154037) +- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804) +- [Endpoint data loss prevention (DLP)](/microsoft-365/compliance/endpoint-dlp-learn-about) +- [Insider risk management](/microsoft-365/compliance/insider-risk-management) ++> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https:%2F%2Faka.ms%2FMDEp2OpenTrial) ++You'll need to go through the onboarding section of the Defender for Endpoint portal to onboard any of the supported devices. Depending on the device, you'll be guided with appropriate steps and provided management and deployment tool options suitable for the device. ++Devices in your organization must be configured so that the Defender for Endpoint service can get sensor data from them. There are various methods and deployment tools that you can use to configure the devices in your organization. ++In general, you'll identify the client you're onboarding, then follow the corresponding tool appropriate to the device or your environment. +++## Related topics +- [Onboard Windows devices using Mobile Device Management tools](configure-endpoints-mdm.md) +- [Onboard Windows devices using Group Policy](configure-endpoints-gp.md) +- [Onboard Windows devices using a local script](configure-endpoints-script.md) +- [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) |
| security | Onboard Windows Server | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/onboard-windows-server.md | + + Title: Defender for Endpoint onboarding Windows Server +description: Onboard Windows Server to Microsoft Defender for Endpoint. +keywords: onboarding, Microsoft Defender for Endpoint onboarding, sccm, group policy, mdm, local script, detection test +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +++ms.localizationpriority: medium ++audience: ITPro ++ - M365-security-compliance + - m365-initiative-defender-endpoint ++ms.technology: mde +++# Defender for Endpoint onboarding Windows Server +++**Applies to:** +- Windows Server 2012 R2 +- Windows Server 2016 +- Windows Server Semi-Annual Enterprise Channel +- Windows Server 2019 and later +- Windows Server 2019 core edition +- Windows Server 2022 +- [Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint) ++> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https:%2F%2Faka.ms%2FMDEp2OpenTrial) ++You'll need to go through the onboarding section of the Defender for Endpoint portal to onboard any of the supported devices. Depending on the device, you'll be guided with appropriate steps and provided management and deployment tool options suitable for the device. ++Defender for Endpoint extends support to also include the Windows Server operating system. This support provides advanced attack detection and investigation capabilities seamlessly through the Microsoft 365 Defender console. Support for Windows Server provides deeper insight into server activities, coverage for kernel and memory attack detection, and enables response actions. ++This topic describes how to onboard specific Windows servers to Microsoft Defender for Endpoint. ++For guidance on how to download and use Windows Security Baselines for Windows servers, see [Windows Security Baselines.](/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines) ++## Windows Server onboarding overview ++You'll need to complete the following general steps to successfully onboard servers 2008 R2, 2012 R2, 2016, 2019, 2022. +++> [!NOTE] +> Servers are on-boarded using GPs only. ++### Windows Server 2012 R2 and Windows Server 2016 +- Download installation and onboarding packages. +- Apply the installation package. +- Follow the onboarding steps for the corresponding tool. ++### Windows Server Semi-Annual Enterprise Channel and Windows Server 2019 +- Download the onboarding package. +- Follow the onboarding steps for the corresponding tool. ++> [!IMPORTANT] +> In order to be eligible to purchase Microsoft Defender for Endpoint Server SKU, you must have already purchased a combined minimum of any of the following, Windows E5/A5, Microsoft 365 E5/A5 or Microsoft 365 E5 Security subscription licenses. For more information on licensing, see the [Product Terms](https://www.microsoft.com/licensing/terms/productoffering/MicrosoftDefenderforEndpointServer/all). ++## Offboard Windows servers ++You can offboard Windows Server 2012 R2, Windows Server 2016, Windows Server (SAC), Windows Server 2019, and Windows Server 2019 Core edition with the same method available for Windows 10 client devices. ++- [Offboard devices using Configuration Manager](/microsoft-365/security/defender-endpoint/configure-endpoints-sccm#offboard-devices-using-configuration-manager) +- [Offboard and monitor devices using Mobile Device Management tools](/microsoft-365/security/defender-endpoint/configure-endpoints-mdm#offboard-and-monitor-devices-using-mobile-device-management-tools) +- [Offboard devices using Group Policy](/microsoft-365/security/defender-endpoint/configure-endpoints-gp#offboard-devices-using-group-policy) +- [Offboard devices using a local script](/microsoft-365/security/defender-endpoint/configure-endpoints-script#offboard-devices-using-a-local-script) ++After offboarding, you can proceed to uninstall the unified solution package on Windows Server 2012 R2 and Windows Server 2016. ++For other Windows server versions, you have two options to offboard Windows servers from the service: +- Uninstall the MMA agent +- Remove the Defender for Endpoint workspace configuration ++> [!NOTE] +> These offboarding instructions for other Windows server versions also apply if you are running the previous Microsoft Defender for Endpoint for Windows Server 2016 and Windows Server 2012 R2 that requires the MMA. Instructions to migrate to the new unified solution are at [Server migration scenarios in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/server-migration). ++## Related topics ++- [Onboard Windows devices using Microsoft Endpoint Configuration Manager](configure-endpoints-sccm.md) +- [Onboard Windows devices using Group Policy](configure-endpoints-gp.md) +- [Onboard non-persistent virtual desktop infrastructure (VDI) devices](configure-endpoints-vdi.md) |
| security | Overview Endpoint Detection Response | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/overview-endpoint-detection-response.md | ms.technology: mde > Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink) -Defender for Endpoint endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. +Endpoint detection and response capabilities in Defender for Endpoint provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. When a threat is detected, alerts are created in the system for an analyst to investigate. Alerts with the same attack techniques or attributed to the same attacker are aggregated into an entity called an _incident_. Aggregating alerts in this manner makes it easy for analysts to collectively investigate and respond to threats. +> [!NOTE] +> Defender for Endpoint detection is not intended to be an auditing or logging solution that records every operation or activity that happens on a given endpoint. Our sensor has an internal throttling mechanism, so the high rate of repeat identical events will not flood the logs. + > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4o1j5] > [!IMPORTANT] |
| security | Run Analyzer Macos Linux | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/run-analyzer-macos-linux.md | ms.technology: m365d 1. Download the [XMDE Client Analyzer](https://aka.ms/XMDEClientAnalyzer) tool to the macOS or Linux machine you need to investigate. > [!NOTE]- > The current SHA256 hash of 'XMDEClientAnalyzer.zip' that is downloaded from the above link is: 'AFD674A149F139E80F1AE90E36814DAAC08AAD9E8B0DA20CB1D3FA33B9D0D1AD'. + > The current SHA256 hash of 'XMDEClientAnalyzer.zip' that is downloaded from the above link is: '94DBD785249C10F37D7BE9C1E881AA096CF3A9F30E829DBBFD42683717BC5DA8'. 2. Extract the contents of XMDEClientAnalyzer.zip on the machine. |
| security | Tamperprotection Macos | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/tamperprotection-macos.md | When tamper protection is set to audit or block mode, you can expect the followi - Creation of new files under Defender for Endpoint location is logged (audited) - Deletion of Defender for Endpoint files is logged (audited) - Renaming of Defender for Endpoint files is logged (audited)-- Commands to stop the agent fail **Block mode**: You can configure the tamper protection mode by providing the mode name as enfor > [!NOTE] >-> - The mode change will apply immediately. You don't need to change the feature flag nor restart Microsoft Defender for Endpoint. +> - The mode change will apply immediately. > - If you used JAMF during the initial configuration, then you'll need to update the configuration using JAMF as well. ## Before you begin You can configure the tamper protection mode by providing the mode name as enfor **Highly recommended settings:** -1. System Integrity Protection (SIP) enabled. For more information, see [Disabling and Enabling System Integrity Protection](https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection). -1. Use a Mobile device management (MDM) tool to configure Microsoft Defender for Endpoint. +- System Integrity Protection (SIP) enabled. For more information, see [Disabling and Enabling System Integrity Protection](https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection). +- Use a Mobile device management (MDM) tool to configure Microsoft Defender for Endpoint. ## Configure tamper protection on macOS devices There are several ways you can configure tamper protection: ### Before you begin -Verify that "tamper_protection" is set to "disabled". +Verify that "tamper_protection" is set to "disabled" to observe the state change.  Tampering alert is raised in the Microsoft 365 Defender portal ### Verify block mode and audit modes - Using Advanced hunting, you'll see tampering alerts appear-- Tampering events can be found in the local device logs: `sudo grep -F '\[{tamperProtection}\]' /Library/Logs/Microsoft/mdatp/microsoft_defender_core.log`+- Tampering events can be found in the local device logs: `sudo grep -F '[{tamperProtection}]' /Library/Logs/Microsoft/mdatp/microsoft_defender_core.log`  |
| security | Tvm Hunt Exposed Devices | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-vulnerability-management/tvm-hunt-exposed-devices.md | Advanced hunting is a query-based threat-hunting tool that lets you explore up t ### Schema tables -- [DeviceTvmSoftwareInventory](../defender-endpoint/advanced-hunting-devicetvmsoftwareinventory-table.md) - Inventory of software installed on devices, including their version information and end-of-support status.+- [DeviceTvmSoftwareInventory](../defender/advanced-hunting-devicetvmsoftwareinventory-table.md) - Inventory of software installed on devices, including their version information and end-of-support status. -- [DeviceTvmSoftwareVulnerabilities](../defender-endpoint/advanced-hunting-devicetvmsoftwarevulnerabilities-table.md) - Software vulnerabilities found on devices and the list of available security updates that address each vulnerability.-- +- [DeviceTvmSoftwareVulnerabilities](../defender/advanced-hunting-devicetvmsoftwarevulnerabilities-table.md) - Software vulnerabilities found on devices and the list of available security updates that address each vulnerability. +- [DeviceTvmSoftwareVulnerabilitiesKB](../defender/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md) - Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available. -- [DeviceTvmSoftwareVulnerabilitiesKB](../defender-endpoint/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md) - Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available.+- [DeviceTvmSecureConfigurationAssessment](../defender/advanced-hunting-devicetvmsecureconfigurationassessment-table.md) - Defender Vulnerability Management assessment events, indicating the status of various security configurations on devices. -- [DeviceTvmSecureConfigurationAssessment](../defender-endpoint/advanced-hunting-devicetvmsecureconfigurationassessment-table.md) - Threat and vulnerability management assessment events, indicating the status of various security configurations on devices.--- [DeviceTvmSecureConfigurationAssessmentKB](../defender-endpoint/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md) - Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks+- [DeviceTvmSecureConfigurationAssessmentKB](../defender/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md) - Knowledge base of various security configurations used by Defender Vulnerability Management to assess devices; includes mappings to various standards and benchmarks +- [DeviceTvmInfoGathering](../defender/advanced-hunting-devicetvminfogathering-table.md) - Assessment events including the status of various configurations and attack surface area states of devices +- [DeviceTvmInfoGatheringKB](../defender/advanced-hunting-devicetvminfogatheringkb-table.md) - List of various configuration and attack surface area assessments used by Defender Vulnerability Management information gathering to assess devices ## Check which devices are involved in high severity alerts 1. Go to **Hunting** \> **Advanced hunting** from the left-hand navigation pane of the Microsoft 365 Defender portal. -2. Scroll down to the TVM advanced hunting schemas to familiarize yourself with the column names. +2. Scroll through advanced hunting schemas to familiarize yourself with the column names. 3. Enter the following queries: Advanced hunting is a query-based threat-hunting tool that lets you explore up t ## Related topics - [Security recommendations](tvm-security-recommendation.md)-- [Configure data access for threat and vulnerability management roles](../defender-endpoint/user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)+- [Configure data access for Defender Vulnerability Management roles](../defender-endpoint/user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group) - [Advanced hunting overview](/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview) - [All advanced hunting tables](/microsoft-365/security/defender-endpoint/advanced-hunting-schema-reference) |
| security | Advanced Hunting Devicefilecertificateinfo Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicefilecertificateinfo-table.md | For information on other tables in the advanced hunting schema, [see the advance | `CertificateExpirationTime` | `datetime` | Date and time the certificate is set to expire | | `CertificateCountersignatureTime` | `datetime` | Date and time the certificate was countersigned | | `IsTrusted` | `boolean` | Indicates whether the file is trusted based on the results of the WinVerifyTrust function, which checks for unknown root certificate information, invalid signatures, revoked certificates, and other questionable attributes |-| `IsRootSignerMicrosoft` | `boolean` | Indicates whether the signer of the root certificate is Microsoft | +| `IsRootSignerMicrosoft` | `boolean` | Indicates whether the signer of the root certificate is Microsoft and if the file is included in Windows operating system | | `ReportId` | `long` | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns. | ## Related topics |
| security | Advanced Hunting Devicetvminfogathering Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvminfogathering-table.md | + + Title: DeviceTvmInfoGathering table in the advanced hunting schema +description: Learn about the assessment events including the status of various configurations and attack surface area states of devices in the DeviceTvmInfoGathering table of the advanced hunting schema. +keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro +++ms.technology: m365d +++# DeviceTvmInfoGathering ++++**Applies to:** +- Microsoft 365 Defender +- Microsoft Defender for Endpoint ++>[!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ++The `DeviceTvmInfoGathering` table in the advanced hunting schema contains [Microsoft Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management) assessment events including the status of various configurations and attack surface area states of devices. You can use this table to hunt for assessment events related to mitigation for zero-days, posture assessment for emerging threats supporting threat analytics mitigation status reports, enabled TLS protocol versions on servers, and more. Use this reference to construct queries that return information from the table. ++For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md). ++| Column name | Data type | Description | +|-|--|-| +| `Timestamp` | `datetime` | Date and time when the event was recorded | +| `LastSeenTime` | `datetime` | Date and time when the service last saw the device | +| `DeviceId` | `string` | Unique identifier for the device in the service | +| `DeviceName` | `string` | Fully qualified domain name (FQDN) of the device | +| `OSPlatform` | `string` | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. | +| `AdditionalFields` | `string` | Additional information about the event | ++For example, to view devices affected by the [Log4Shell vulnerability](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/) where the workaround mitigation hasn't been applied yet, or has been applied and is pending reboot, you can use the following query. ++```kusto +DeviceTvmInfoGathering +| where AdditionalFields.Log4JEnvironmentVariableMitigation in ("RebootRequired", "false") +| join kind=inner ( + DeviceTvmSoftwareVulnerabilities + | where CveId == "CVE-2021-44228" +) on DeviceId +| summarize any(DeviceName), any(AdditionalFields.Log4JEnvironmentVariableMitigation) by DeviceId +``` ++## Related topics +- [DeviceTvmInfoGatheringKB](advanced-hunting-devicetvminfogatheringkb-table.md) +- [Understand the schema](advanced-hunting-schema-tables.md) +- [Apply query best practices](advanced-hunting-best-practices.md) +- [Overview of Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) +- [Learn how to manage the Log4Shell vulnerability in Microsoft Defender for Endpoint](/microsoft-365/security/defender-endpoint/tvm-manage-log4shell-guidance) |
| security | Advanced Hunting Devicetvminfogatheringkb Table | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/advanced-hunting-devicetvminfogatheringkb-table.md | + + Title: DeviceTvmInfoGatheringKB table in the advanced hunting schema +description: Learn about the metadata for assessment events in the DeviceTvmInfoGathering table of the advanced hunting schema. +keywords: advanced hunting, threat hunting, cyber threat hunting, Microsoft 365 Defender, microsoft 365, m365, search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities +search.product: eADQiWindows 10XVcnh +search.appverid: met150 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +f1.keywords: + - NOCSH +++ms.localizationpriority: medium ++audience: ITPro +++ms.technology: m365d +++# DeviceTvmInfoGatheringKB ++++**Applies to:** +- Microsoft 365 Defender +- Microsoft Defender for Endpoint ++>[!IMPORTANT] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. ++The `DeviceTvmInfoGatheringKB` table in the advanced hunting schema contains metadata for [Microsoft Defender Vulnerability Management](/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management) assessment events data collected in the `DeviceTvmInfoGathering` table. The `DeviceTvmInfoGatheringKB` table contains the list of various configuration and attack surface area assessments used by Defender Vulnerability Management information gathering to assess devices. Use this reference to construct queries that return information from the table. ++For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-schema-tables.md). ++| Column name | Data type | Description | +|-|--|-| +| `IgId` | `string` | Unique identifier for the piece of information gathered | +| `FieldName` | `string` | Name of the field where this information appears in the AdditionalFields column of the DeviceTvmInfoGathering table | +| `Description` | `string` | Description of the information gathered | +| `Categories` | `string` | List of categories that the information belongs to, in JSON array format | +| `DataStructure` | `string` | The data structure of the information gathered | ++You can use this table to explore the kinds of information available in `DeviceTvmInfoGathering` so you can later fine-tune your hunting query. ++For instance, to see the list of information being collected, you can try the following query: ++```kusto +// Check out what is being collected +DeviceTvmInfoGatheringKB +``` ++From the results, say you become interested in the available categories, you can use the following query: ++```kusto +// Return all available categories +DeviceTvmInfoGatheringKB +| mv-expand Categories to typeof(string) +| distinct Categories +``` ++Then, let's say you want to see the assessment categories involving the TLS protocol: ++```kusto +// Return all findings for a specified category +DeviceTvmInfoGatheringKB +| where Categories contains "tls" +``` ++Using the resulting fields, you can then use the `DeviceTvmInfoGathering` table to get a list of devices using TLS client version 1.0. ++```kusto +// Return all devices on which the TLS version 1.0 is enabled +DeviceTvmInfoGathering +| where AdditionalFields.TlsClient10 == "Enabled" or AdditionalFields.TlsServer10 == "Enabled" +``` ++++## Related topics +- [DeviceTvmInfoGathering](advanced-hunting-devicetvminfogathering-table.md) +- [Understand the schema](advanced-hunting-schema-tables.md) +- [Apply query best practices](advanced-hunting-best-practices.md) +- [Overview Defender Vulnerability Management](/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt) |
| security | Configure Siem Defender | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/configure-siem-defender.md | For more information on Microsoft 365 Defender incident properties including con ### Splunk -Using the Microsoft 365 Defender Add-on for Splunk that supports: +Using the new, fully-supported Splunk Add-on for Microsoft Security that supports: - Ingesting incidents that contain alerts from the following products, which are mapped onto Splunk's Common Information Model (CIM): Using the Microsoft 365 Defender Add-on for Splunk that supports: - Microsoft Defender for Identity and Azure Active Directory Identity Protection - Microsoft Defender for Cloud Apps -- Updating incidents in Microsoft 365 Defender from within Splunk- - Ingesting Defender for Endpoint alerts (from the Defender for Endpoint's Azure endpoint) and updating these alerts -For more information on the Microsoft 365 Defender Add-on for Splunk, see [splunkbase](https://splunkbase.splunk.com/app/4959/). +- Support for updating Microsoft 365 Defender Incidents and/or Microsoft Defender for Endpoint Alerts and the respective dashboards has been moved to the Microsoft 365 App for Splunk. ++For more information on: ++- The Splunk Add-on for Microsoft Security, see the [Microsoft Security Add-on on Splunkbase](https://splunkbase.splunk.com/app/6207/#/overview) ++- The Microsoft 365 App for Splunk, see the [Microsoft 365 App on Splunkbase](https://splunkbase.splunk.com/app/3786/) ### Micro Focus ArcSight Framework (CEF). For more information on the new ArcSight SmartConnector for Microsoft 365 Defender, see [ArcSight Product Documentation](https://community.microfocus.com/cyberres/productdocs/w/connector-documentation/39246/smartconnector-for-microsoft-365-defender). -The SmartConnector replaces the previous FlexConnector for Microsoft Defender for Endpoint. +The SmartConnector replaces the previous FlexConnector for Microsoft Defender for Endpoint that has been deprecated. ## Ingesting streaming event data via Event Hubs First you need to stream events from your AAD tenant to your Event Hubs or Azure For more information on the event types supported by the Streaming API, see [Supported streaming event types](../defender/supported-event-types.md). ### Splunk-Use the Splunk Add-on for Microsoft Cloud Services to ingest events from Azure Event Hubs. +Use the Splunk Add-on for Microsoft Cloud Services to ingest events from Azure Event Hubs. -For more information on the Splunk Add-on for Microsoft Cloud Services, see [splunkbase](https://splunkbase.splunk.com/app/3110/). +For more information on the Splunk Add-on for Microsoft Cloud Services, see the [Microsoft Cloud Services Add-on on Splunkbase](https://splunkbase.splunk.com/app/3110/). ### IBM QRadar->Use the new IBM QRadar Microsoft 365 Defender Device Support Module (DSM) that calls the [Microsoft 365 Defender Streaming API](streaming-api.md) that allows ingesting streaming event data from Microsoft 365 Defender products. For more information on supported event types, see [Supported event types](supported-event-types.md). +>Use the new IBM QRadar Microsoft 365 Defender Device Support Module (DSM) that calls the [Microsoft 365 Defender Streaming API](streaming-api.md) that allows ingesting streaming event data from Microsoft 365 Defender products via Event Hubs or Azure Storage Account. For more information on supported event types, see [Supported event types](supported-event-types.md). |
| security | Streaming Api Storage | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/streaming-api-storage.md | ms.technology: mde 2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to Microsoft.Insights**. +### Add contributor permissions ++Once the Storage account is created you will need to: ++1. Define the user who will be logging into Microsoft 365 Defender as Contributor. ++ Go to **Storage Account > Access control (IAM) > Add** and verify under **Role assignments**. + ## Enable raw data streaming 1. Log in to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft 365 Defender</a> as a ***Global Administrator*** or ***Security Administrator***. In order to get the data types for our events properties do the following: :::image type="content" source="../defender-endpoint/images/machine-info-datatype-example.png" alt-text="An example device info query" lightbox="../defender-endpoint/images/machine-info-datatype-example.png"::: +## Monitoring created resources ++You can monitor the resources created by the streaming API using **Azure Monitor**. +For more information, see [Monitor destinations - Azure Monitor | Microsoft Docs](/azure/azure-monitor/logs/logs-data-export?tabs=portal#monitor-destinations). + ## Related topics - [Overview of Advanced Hunting](../defender/advanced-hunting-overview.md) |
| security | Whats New | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender/whats-new.md | ms.technology: m365d [!INCLUDE [Microsoft 365 Defender rebranding](../includes/microsoft-defender.md)] ->The following features are in preview or generally available (GA) in the latest release of Microsoft 365 Defender. +Lists the new features and functionality in Microsoft 365 Defender. RSS feed: Get notified when this page is updated by copying and pasting the following URL into your feed reader: For more information on what's new with other Microsoft Defender security produc You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter). +## June 2022 +- (Preview) The [DeviceTvmInfoGathering](advanced-hunting-devicetvminfogathering-table.md) and [DeviceTvmInfoGatheringKB](advanced-hunting-devicetvminfogatheringkb-table.md) tables are now available in the advanced hunting schema. Use these tables to hunt through assessment events in Defender Vulnerability Management including the status of various configurations and attack surface area states of devices. + ## May 2022 - (Preview) In line with the recently announced expansion into a new service category called [Microsoft Security Experts](https://aka.ms/MicrosoftSecurityExperts), we're introducing the availability of [Microsoft Defender Experts for Hunting](defenderexpertsforhuntingprev.md) (Defender Experts for Hunting) for public preview. Defender Experts for Hunting is for customers who have a robust security operations center but want Microsoft to help them proactively hunt for threats across Microsoft Defender data, including endpoints, Office 365, cloud applications, and identity. |
| security | About Defender For Office 365 Trial | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/about-defender-for-office-365-trial.md | The licensing card for the trial shows the following information: - You have custom polices that are scoped to specific users. - **Full protection**: The total number of users that are protected by Defender for Office 365 Plan 2 features (AIR, Threat Explorer, Attack simulation training, etc.). +For pricing information, see [Microsoft Defender for Office 365](https://www.microsoft.com/security/business/siem-and-xdr/microsoft-defender-office-365). + ## Permissions To start or end the trial, you need to be a member of the **Global Administrator** or **Security Administrator** roles in Azure Active Directory. For details, see [About admin roles](../../admin/add-users/about-admin-roles.md). |
| security | Install App Guard | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/install-app-guard.md | ms.prod: m365-security # Application Guard for Office for admins -**Applies to:** Word, Excel, and PowerPoint for Microsoft 365, Windows 10 Enterprise, Windows 11 Enterprise +**Applies to:** Word, Excel, and PowerPoint for Microsoft 365 Apps, Windows 10 Enterprise, Windows 11 Enterprise Microsoft Defender Application Guard for Office (Application Guard for Office) helps prevent untrusted files from accessing trusted resources, keeping your enterprise safe from new and emerging attacks. This article walks admins through setting up devices for a preview of Application Guard for Office. It provides information about system requirements and installation steps to enable Application Guard for Office on a device. Microsoft Defender Application Guard for Office (Application Guard for Office) h ### Minimum software requirements * **Windows**: Windows 10 Enterprise edition, Client Build version 2004 (20H1) build 19041 or later. All versions of Windows 11 are supported.-* **Office**: Office Current Channel and Monthly Enterprise Channel, Build version 2011 16.0.13530.10000 or later. Office Semi-Annual Enterprise Channel, Build version 2108 or later. Both 32-bit and 64-bit versions of Office are supported. +* **Office**: Microsoft 365 Apps with build 16.0.13530.10000 or later. For Current Channel and Monthly Enterprise Channel installations, this equals to version 2011. For Semi-Annual Enterprise Channel and Semi-Annual Enterprise Channel (Preview), the minimum version is 2108 or later. Both 32-bit and 64-bit versions are supported. * **Update package**: Windows 10 cumulative monthly security update [KB4571756](https://support.microsoft.com/help/4571756/windows-10-update-KB4571756) For detailed system requirements, refer to [System requirements for Microsoft Defender Application Guard](/windows/security/threat-protection/microsoft-defender-application-guard/reqs-md-app-guard). Also, please refer to your computer manufacturer's guides on how to enable virtualization technology.-To learn more about Office update channels, see [Overview of update channels for Microsoft 365](/deployoffice/overview-update-channels). +To learn more about Microsoft 365 Apps update channels, see [Overview of update channels for Microsoft 365 Apps](/deployoffice/overview-update-channels). ### Licensing requirements |
| security | Trial Playbook Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/trial-playbook-defender-for-office-365.md | search.appverid: - MOE150 - MET150 description: "Microsoft Defender for Office 365 solutions trial playbook."+ # Trial playbook: Microsoft Defender for Office 365 |
| security | Try Microsoft Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/try-microsoft-defender-for-office-365.md | When you evaluate Defender for Office 365, the policies that control protection [Enhanced Filtering for Connectors](/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/enhanced-filtering-for-connectors) (also known as *skip listing*) is automatically configured on the connector that you specify. - When a third-party service or device sits in from of Microsoft 365, Enhanced Filtering for Connectors correctly identifies the source of internet messages, and greatly improves the accuracy of the Microsoft filtering stack (especially [spoof intelligence](anti-spoofing-protection.md), as well as post-breach capabilities in [Threat Explorer](threat-explorer.md) and [Automated Investigation & Response (AIR)](automated-investigation-response-office.md)). + When a third-party service or device sits in front of Microsoft 365, Enhanced Filtering for Connectors correctly identifies the source of internet messages and greatly improves the accuracy of the Microsoft filtering stack (especially [spoof intelligence](anti-spoofing-protection.md), as well as post-breach capabilities in [Threat Explorer](threat-explorer.md) and [Automated Investigation & Response (AIR)](automated-investigation-response-office.md)). - **List each gateway IP address your messages pass through**: This setting is available only if you selected **Other** for **Select a third party service provider**. Enter a comma-separated list of the IP addresses that are used by the third-party protection service or device to send mail into Microsoft 365. |
| security | User Submission | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/user-submission.md | Delivering user reported messages to a custom mailbox instead of directly to Mic ## Custom mailbox prerequisites Use the following articles to configure the prerequisites required so user reported messages go to your custom mailbox:-+ - [Identify the custom mailbox as a SecOps mailbox in the advanced delivery policy](configure-advanced-delivery.md#use-the-microsoft-365-defender-portal-to-configure-secops-mailboxes-in-the-advanced-delivery-policy) -- [Create an anti-malware policy](configure-your-spam-filter-policies.md#use-the-microsoft-365-defender-portal-to-create-anti-spam-policies) for the custom mailbox where zero-hour auto purge (ZAP) for malware is turned off (**Protection settings** section \> **Enable zero-hour auto purge for malware** is not selected).+- [Create an anti-malware policy](configure-your-spam-filter-policies.md#use-the-microsoft-365-defender-portal-to-create-anti-spam-policies) for the custom mailbox where + - zero-hour auto purge (ZAP) for malware is turned off (**Protection settings** section \> **Enable zero-hour auto purge for malware** is not selected). + - the common attachment filter option is turned off (**Protection settings** section \> **Enable the common attachments filter** is not selected). If you have Microsoft Defender for Office 365, you should also configure the following settings so that our advanced filtering does not impact the users reporting messages: +- [Make sure the custom mailbox is not part of any preset security policies](preset-security-policies.md#use-the-microsoft-365-defender-portal-to-modify-the-assignments-of-standard-and-strict-preset-security-policies) + - [Create a Safe Links policy](set-up-safe-links-policies.md) for the custom mailbox where Safe Links scanning is turned off (**Select the action for unknown potentially malicious URLs in messages** section \> **Off**). - [Create a Safe Attachments policy](set-up-safe-attachments-policies.md) for the custom mailbox where Safe Attachments scanning is turned off (**Safe Attachments unknown malware response** section \> **Off**). |
| security | Whats New In Defender For Office 365 | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/whats-new-in-defender-for-office-365.md | For more information on what's new with other Microsoft Defender security produc - [Introducing the URLClickEvents table in Microsoft 365 Defender Advanced Hunting](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/introducing-the-urlclickevents-table-in-advanced-hunting-with/ba-p/3295096): Introducing the UrlClickEvents table in advanced hunting with Microsoft Defender for Office 365. - [Manual email remediation enhancements](/microsoft-365/security/office-365-security/remediate-malicious-email-delivered-office-365): Bringing manual email purge actions taken in Microsoft Defender for Office 365 to the Microsoft 365 Defender (M365D) unified Action Center using a new action-focused investigation.+- [Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/introducing-differentiated-protection-for-priority-accounts-in/ba-p/3283838): Introducing the general availability of differentiated protection for priority accounts. ## March 2022 |
| solutions | Collaborate Teams Direct Connect | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/solutions/collaborate-teams-direct-connect.md | As part of this configuration, we enable the **Office 365** application, which i > [!NOTE] > Changes to cross-tenant access settings may take up to three hours fifteen minutes to take effect. +> [!NOTE] +> Shared channels between Commercial and GCC clouds are not supported. + ### Add an organization Add each organization with which you want to participate in shared channels. |
| whiteboard | Deploy On Windows Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/deploy-on-windows-organizations.md | Whiteboard can be deployed on devices that run Windows 10 or later using Microso ## See also -[Enable and manage access to Whiteboard](enable-whiteboard-access-organizations.md) +[Manage access to Whiteboard](manage-whiteboard-access-organizations.md) [Manage data for Whiteboard](manage-data-organizations.md) |
| whiteboard | Index | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/index.md | Microsoft Whiteboard in Microsoft 365 is a free-form, digital canvas where peopl The resources in this section help you learn more about what Microsoft Whiteboard is and how it can help your organization. -| If you're looking for this information: | Go to this resource: | +| If you're looking for this information | Go to this resource | |:--|:--| |Learn how to get Microsoft Whiteboard|[Microsoft Whiteboard product page](https://www.microsoft.com/en-us/microsoft-365/microsoft-whiteboard/digital-whiteboard-app)| |Find resources in the Microsoft Tech Community Resource Center|[Microsoft 365 Whiteboard blog](https://techcommunity.microsoft.com/t5/microsoft-365-blog/bg-p/microsoft_365blog/label-name/Microsoft%20Whiteboard)| The resources in this section help the admin in your organization to set up and ### For organizations -| If you're looking for this information: | Go to this resource: | +| If you're looking for this information | Go to this resource | |:--|:--|-|Learn how to set up and manage access to Whiteboard for your organization|[Enable and manage access to Whiteboard](enable-whiteboard-access-organizations.md)| +|Learn how to set up and manage access to Whiteboard for your organization|[Manage access to Whiteboard](manage-whiteboard-access-organizations.md)| |Find where your Whiteboard content and data are stored in Azure and OneDrive for Business |[Manage data for Whiteboard](manage-data-organizations.md) | |Learn about the sharing experience in Teams and how to share links to specific users |[Manage sharing for Whiteboard](manage-sharing-organizations.md) | |Deploy Whiteboard on devices that run Windows 10 or later using Microsoft Intune or Microsoft Configuration Manager |[Deploy Whiteboard on Windows](deploy-on-windows-organizations.md) | ### For government -| If you're looking for this information: | Go to this resource: | +| If you're looking for this information | Go to this resource | |:--|:--|-|Learn how to set up and manage access to Whiteboard for US Government GCC High environments|[Enable and manage access to Whiteboard - GCC High](enable-whiteboard-access-gcc-high.md)| +|Learn how to set up and manage access to Whiteboard for US Government GCC High environments|[Manage access to Whiteboard - GCC High](manage-whiteboard-access-gcc-high.md)| |Find where your Whiteboard content and data are stored in Azure and OneDrive for Business in US Government GCC High environments |[Manage data for Whiteboard - GCC High](manage-data-gcc-high.md) | |Learn about the sharing experience in Teams and how to share links to specific users in US Government GCC High environments |[Manage sharing for Whiteboard - GCC High](manage-sharing-gcc-high.md) | |Learn which clients are currently supported for Whiteboard in US Government GCC High environments |[Manage clients for Whiteboard - GCC High](manage-clients-gcc-high.md) | ## Whiteboard PowerShell -| If you're looking for this information: | Go to this resource: | +| If you're looking for this information | Go to this resource | |:--|:--| |Find PowerShell cmdlet help references to manage Microsoft Whiteboard|[PowerShell for Whiteboard](/powershell/module/whiteboard/)| |
| whiteboard | Manage Clients Gcc High | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-clients-gcc-high.md | The following clients are planned for future releases of Whiteboard: ## See also -[Enable and manage access to Whiteboard - GCC High](enable-whiteboard-access-gcc-high.md) +[Manage access to Whiteboard - GCC High](manage-whiteboard-access-gcc-high.md) [Manage data for Whiteboard - GCC High](manage-data-gcc-high.md) |
| whiteboard | Manage Data Gcc High | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-data-gcc-high.md | The following data controls are planned for future releases of Whiteboard: ## See also -[Enable and manage access to Whiteboard - GCC High](enable-whiteboard-access-gcc-high.md) +[Manage access to Whiteboard - GCC High](manage-whiteboard-access-gcc-high.md) [Manage sharing for Whiteboard - GCC High](manage-sharing-gcc-high.md) |
| whiteboard | Manage Data Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-data-organizations.md | Data controls planned for future releases: ## See also -[Enable and manage access to Whiteboard](enable-whiteboard-access-organizations.md) +[Manage access to Whiteboard](manage-whiteboard-access-organizations.md) [Manage sharing for Whiteboard](manage-sharing-organizations.md) |
| whiteboard | Manage Sharing Gcc High | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-sharing-gcc-high.md | When you share a whiteboard from the web, desktop, or mobile clients, you can ch ## See also -[Enable and manage access to Whiteboard - GCC High](enable-whiteboard-access-gcc-high.md) +[Manage access to Whiteboard - GCC High](manage-whiteboard-access-gcc-high.md) [Manage data for Whiteboard - GCC High](manage-data-gcc-high.md) |
| whiteboard | Manage Sharing Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-sharing-organizations.md | When you share whiteboards from the web, desktop, or mobile clients, you can cho ## See also -[Enable and manage access to Whiteboard](enable-whiteboard-access-organizations.md) +[Manage access to Whiteboard](manage-whiteboard-access-organizations.md) [Manage data for Whiteboard](manage-data-organizations.md) |
| whiteboard | Manage Whiteboard Access Gcc High | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-whiteboard-access-gcc-high.md | + + Title: Manage access to Microsoft Whiteboard for GCC High environments +++++audience: admin +++search.appverid: MET150 ++ms.localizationpriority: medium +description: Learn how to enable, disable, and manage Whiteboard data. +++++# Manage access to Microsoft Whiteboard for GCC High environments ++>[!NOTE] +> This guidance applies to US Government Community Cloud (GCC) High environments. ++Microsoft Whiteboard on OneDrive for Business is enabled by default for applicable Microsoft 365 tenants. It can be enabled or disabled at a tenant-wide level. You should also ensure that **Microsoft Whiteboard Services** is enabled in the **Azure Active Directory admin center** > **Enterprise applications**. ++The following URLs are required: ++- 'https://*.office365.us/' +- 'https://login.microsoftonline.us/' +- 'https://graph.microsoft.us/' +- 'https://graph.microsoftazure.us/' +- 'https://admin.onedrive.us' +- 'https://shell.cdn.office.net/' +- 'https://config.ecs.gov.teams.microsoft.us' +- 'https://tb.events.data.microsoft.com/' ++You can control access to Whiteboard in the following ways: ++- Enable or disable Whiteboard for your entire tenant using the [SharePoint Online PowerShell module](/microsoft-365/enterprise/manage-sharepoint-online-with-microsoft-365-powershell). ++- Show or hide Whiteboard for specific users in meetings using a Teams meeting policy. It will still be visible via the web, native clients, and the Teams tab app. ++- Require conditional access policies for accessing Whiteboard using the Azure Active Directory admin center. ++>[!NOTE] +> Whiteboard on OneDrive for Business doesn't appear in the Microsoft 365 admin center. Teams meeting policy only hides Whiteboard entry points, it doesn't prevent users from using Whiteboard. Conditional access ploicies prevent access to Whiteboard, but doesn't hide the entry points. ++## Enable or disable Whiteboard ++To enable or disable Whiteboard for your tenant, do the following steps: ++1. Use the [SharePoint Online PowerShell module](/microsoft-365/enterprise/manage-sharepoint-online-with-microsoft-365-powershell) to enable or disable all Fluid Experiences across your Microsoft 365 tenant. ++2. Connect to [SharePoint Online PowerShell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). ++3. Enable Fluid using the following <code>Set-SPOTenant</code> cmdlet: ++ <pre><code class="lang-powershell">Set-SPOTenant -IsWBFluidEnabled $true</code></pre> ++The change should take approximately 60 minutes to apply across your tenancy. If you don't see this option, you'll need to update the module. ++>[!NOTE] +> By default, Whiteboard is enabled. If it has been disabled in the Azure Active Directory enterprise applications, then Whiteboard on OneDrive for Business will not work. ++## Show or hide Whiteboard ++To show or hide Whiteboard in meetings, see [Meeting policy settings](/microsoftteams/meeting-policies-content-sharing). ++## See also ++[Manage data for Whiteboard - GCC High](manage-data-gcc-high.md) ++[Manage sharing for Whiteboard - GCC High](manage-sharing-gcc-high.md) ++[Manage clients for Whiteboard - GCC High](manage-clients-gcc-high.md) ++++ |
| whiteboard | Manage Whiteboard Access Organizations | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/whiteboard/manage-whiteboard-access-organizations.md | + + Title: Manage access to Microsoft Whiteboard for your organization +++++audience: admin +++search.appverid: MET150 ++ms.localizationpriority: medium +description: Learn how to set up Microsoft Whiteboard for your organization in the Microsoft 365 admin center. +++++# Manage access to Microsoft Whiteboard for your organization ++>[!NOTE] +> This article applies to Enterprise or Education organizations who use Whiteboard. For US Government GCC High environments, see [Manage access to Microsoft Whiteboard for GCC High environments](manage-whiteboard-access-gcc-high.md). ++Microsoft Whiteboard is a visual collaboration canvas where people, content, and ideas come together. Today, Whiteboard runs on Azure for Enterprise and Education customers. Whiteboard is transitioning to be run on top of OneDrive for Business. This transition will bring many new capabilities and allow you to create, share, discover, and manage whiteboards as easily as any Office document. ++Whiteboard is automatically enabled for applicable Microsoft 365 tenants. ++Whiteboard conforms to global standards including SOC 1, SOC 2, ISO 27001, HIPAA, and EU Model Clauses. ++The following admin settings are required for Whiteboard: ++- Whiteboard must be enabled globally in the Microsoft 365 admin center. ++- The <code>Set-SPOTenant -IsWBFluidEnabled</code> cmdlet must be enabled using [SharePoint Online PowerShell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). ++>[!NOTE] +> The roll out of OneDrive for Business storage is in progress. When you go to the Microsoft 365 admin center, the option to opt in or out of OneDrive for Business storage is disabled if your tenant already has been transitioned to OneDrive for Business. ++You can control access to Whiteboard in the following ways: ++- Enable or disable Whiteboard for your entire tenant using the Microsoft 365 admin center. ++- Show or hide Whiteboard for specific users in meetings using a Teams meeting policy. It will still be visible via the web, native clients, and the Teams tab app. ++- Require conditional access policies for accessing Whiteboard using the Azure Active Directory admin center. ++>[!NOTE] +> Teams meeting policies only hide Whiteboard entry points; it doesn't prevent the users from using Whiteboard. Conditional access policies prevent any access to Whiteboard, but doesn't hide the entry points. ++## Enable or disable Whiteboard ++To enable or disable Whiteboard for your tenant, do the following steps: ++1. Go to the Microsoft 365 admin center. ++2. On the home page of the admin center, in the Search box on the top right, type *Whiteboard*. ++3. In the search results, select **Whiteboard settings**. ++4. On the Whiteboard panel, toggle **Turn Whiteboard on or off for your entire organization** to **On**. ++5. Select **Save**. ++6. Connect to [SharePoint Online PowerShell](/powershell/sharepoint/sharepoint-online/connect-sharepoint-online). ++7. Enable Fluid using the following <code>Set-SPOTenant</code> cmdlet: ++ <pre><code class="lang-powershell">Set-SPOTenant -IsWBFluidEnabled $true</code></pre> + +## Show or hide Whiteboard ++To show or hide Whiteboard in meetings, see [Meeting policy settings](/microsoftteams/meeting-policies-content-sharing). ++## Prevent access to Whiteboard ++To prevent access to Whiteboard for specific users, see [Building a Conditional Access policy](/azure/active-directory/conditional-access/concept-conditional-access-policies). ++## See also ++[Manage data for Whiteboard](manage-data-organizations.md) ++[Manage sharing for Whiteboard](manage-sharing-organizations.md) ++[Deploy Whiteboard on Windows](deploy-on-windows-organizations.md) |